Windows Gets a Powerful New Recovery Tool That Can Undo an Entire Day

If you work in IT, there are certain dates you never forget. July 19, 2024 is one of them.

That’s the day a faulty CrowdStrike update triggered one of the largest IT outages in history, sending millions of Windows PCs into repeated crashes and Blue Screens of Death. The incident exposed a major weakness in Windows recovery: when a machine couldn’t boot, fixing it could require someone to physically access the computer and manually remove the problematic file.

Microsoft promised to make Windows more resilient after the incident. The company has since introduced several recovery improvements, including Quick Machine Recovery.

Now there’s another major addition.

Microsoft has made Point-in-Time Restore generally available on Windows, giving users a way to roll an entire PC back to an earlier working state when a serious software problem makes the system unstable or unable to boot.

Think of it as an emergency “undo” button for your PC.

The feature is designed to make recovery much easier, especially after a failed update, problematic driver installation, incompatible software, or another change that leaves Windows unable to start normally.

What Is Windows Point-in-Time Restore?

Point-in-Time Restore does exactly what its name suggests: it restores a Windows PC to an earlier point in time.

Instead of troubleshooting individual files, drivers, applications, or system settings, Windows can restore the machine using a previously created snapshot.

That snapshot can include:

• Windows system files
• Installed applications
• System settings
• Configuration changes
• Locally stored files

The feature uses Volume Shadow Copy Service (VSS) to create snapshots of the system.

By default, Windows creates approximately one snapshot per day and keeps the three most recent snapshots. The retention period is roughly 72 hours.

This means that if a Windows PC suddenly stops working after a change made earlier in the day, you may be able to return the machine to a state from before the problem appeared.

The biggest advantage is that users don’t have to manually create restoration points every time they install something or change a setting.

How Windows Point-in-Time Restore Works

The feature is designed primarily for situations where Windows cannot boot normally.

After three consecutive unsuccessful startup attempts, Windows can automatically enter the Windows Recovery Environment.

From there, users can select:

Troubleshoot → Point-in-Time Restore

Windows then presents the available recovery snapshots.

After selecting one, you’ll need to confirm the operation and, if BitLocker encryption is enabled, potentially enter the 48-digit BitLocker recovery key.

Windows then restores the selected snapshot.

The process isn’t instant. On test systems, the restoration process took roughly 30 to 45 minutes, although actual recovery time depends on the computer’s hardware, storage speed, and the amount of data that needs to be restored.

Once the process finishes, Windows should return to the state captured by the selected snapshot.

How Much Storage Does Point-in-Time Restore Use?

One of the interesting aspects of the feature is how little storage the snapshots can require.

Windows allocates up to 2% of the system drive by default for these recovery snapshots. The feature also shares storage with Windows Reserved Storage.

Because the snapshots are incremental and use the Volume Shadow Copy system, they don’t require a complete duplicate of the entire drive for every restore point.

For example, a system with a 128GB system drive and 8GB of RAM used around 2.2GB for two recovery points in testing.

On a much larger system with a 700GB system drive, three snapshots consumed approximately 9GB.

Windows can also manage this storage automatically and remove older snapshots when additional disk space is required.

Users can change the maximum amount of storage allocated to Point-in-Time Restore from its settings page.

Point-in-Time Restore vs. System Restore

At first glance, Microsoft’s new feature may sound almost identical to the traditional System Restore feature that’s been part of Windows for decades.

They’re actually quite different.

System Restore dates back to Windows Me in 2000 and remains available in the legacy Windows Control Panel.

When enabled, System Restore typically creates restore points around events such as driver installations and Windows updates. Users can also create restore points manually.

The major difference is what gets restored.

System Restore

Traditional System Restore focuses primarily on Windows system components, drivers, registry settings, and other operating-system changes.

Your personal documents generally aren’t affected.

Point-in-Time Restore

Point-in-Time Restore takes a broader snapshot of the system.

That means the restoration can affect locally stored files as well as system and application changes.

This is an important distinction.

If you create or modify a document after the snapshot was taken and then restore the computer to that earlier snapshot, that local change can be lost.

That’s why Microsoft expects users to keep important files synchronized with cloud storage or another backup solution.

Why Point-in-Time Restore Is Different

The biggest advantage isn’t necessarily that Point-in-Time Restore can do something completely impossible with traditional recovery tools.

It’s the simplicity and automation.

System Restore can be disabled, configured incorrectly, or simply forgotten. Users may also discover that their available restore points don’t go back far enough.

Point-in-Time Restore is designed to operate quietly in the background and maintain recent snapshots automatically.

You don’t have to remember to create a restore point before installing a driver or application.

And when Windows can’t boot, the recovery option is integrated directly into the Windows Recovery Environment.

For ordinary users, that’s a much simpler recovery experience.

How to Enable Point-in-Time Restore in Windows 11

On supported systems, Point-in-Time Restore can already be enabled automatically.

Microsoft says the feature is enabled by default on supported retail and OEM installations of Windows 11 Home and Pro when the system drive has at least 200GB of capacity.

If the system drive is smaller than 200GB, you can enable the feature manually if your Windows installation supports it.

Go to:

Settings → System → Recovery

Look for Point-in-Time Restore, then select View or change and turn the feature on.

Windows will then begin managing recovery snapshots according to its default configuration.

What About Windows 11 Enterprise?

Enterprise editions work somewhat differently.

On Windows 11 Enterprise, Point-in-Time Restore is disabled by default.

Organizations may need administrator approval before enabling it, which makes sense for managed business environments where recovery policies are controlled centrally.

Enterprise administrators also get additional configuration options that aren’t currently exposed to ordinary Home and Pro users.

For example, Enterprise installations can configure settings such as:

• How frequently snapshots are created
• How many snapshots are retained
• Storage allocation

For consumers, those options may appear unavailable or grayed out.

That’s intentional rather than a Windows bug.

Can You Change How Often Windows Creates Snapshots?

For most users, no.

The default behavior is approximately one snapshot per day, with the latest three snapshots retained.

Microsoft currently limits more advanced configuration to Windows 11 Enterprise systems.

That means Home and Pro users generally can’t choose their own snapshot schedule or specify a custom number of restore points.

For most people, that’s probably a reasonable compromise because the feature is intended to work automatically rather than become another system-management task.

The Biggest Risk: Losing Recent Files

Point-in-Time Restore is powerful, but there’s one major warning you shouldn’t ignore.

Restoring your PC can remove files and changes made after the selected snapshot was created.

Imagine you install a problematic driver at 3 p.m. and your computer becomes unusable at 5 p.m.

Your latest snapshot may have been created earlier in the day.

Restoring it could fix Windows, but any local documents or other changes created after that snapshot may disappear.

Microsoft clearly warns users about this before the restoration begins.

Still, it’s easy to imagine someone overlooking that warning when they’re staring at a computer that won’t boot.

For that reason, Point-in-Time Restore should never be considered a replacement for backups.

Important documents should still be stored in a reliable cloud service, external backup, or another independent storage location.

What Happens If BitLocker Is Enabled?

BitLocker adds another potential step to the recovery process.

If the system drive is encrypted, Windows may require the BitLocker recovery key before allowing the recovery operation to continue.

That’s not unique to Point-in-Time Restore. It’s part of the security model of an encrypted Windows installation.

Before you need emergency recovery, make sure you know where your BitLocker recovery key is stored.

Losing access to that key at the exact moment Windows fails could turn a relatively straightforward recovery process into a much bigger problem.

Can Point-in-Time Restore Be Used Remotely?

Not yet in the way many corporate IT administrators would probably prefer.

Microsoft’s roadmap includes the ability to manage Point-in-Time Restore remotely through Microsoft Intune, but that capability isn’t currently available.

That’s an important limitation for large organizations.

The original CrowdStrike outage demonstrated how expensive physical recovery can become when thousands of computers fail simultaneously.

A recovery system that could eventually be triggered and managed remotely through enterprise management tools would make the technology considerably more valuable for businesses.

Could Point-in-Time Restore Have Helped During the CrowdStrike Outage?

Potentially, but it’s important not to oversimplify the comparison.

The July 2024 CrowdStrike incident involved a faulty security software update that caused Windows systems to crash. Recovery often required administrators to boot affected machines into recovery mode and remove the problematic file.

A snapshot-based recovery mechanism could potentially make certain failures easier to reverse because administrators wouldn’t necessarily have to manually locate and delete the offending component.

However, whether it would work in every CrowdStrike-style scenario depends on when the snapshot was created, what was captured, and how the recovery environment handled the affected system.

Point-in-Time Restore is therefore best viewed as one more recovery layer, rather than a universal solution to catastrophic software failures.

Is Point-in-Time Restore Worth Enabling?

For most supported Windows 11 users, yes.

There’s little reason not to enable it if you have enough storage and understand what the feature does.

It can provide an additional safety net when:

• A Windows update breaks the system
• A driver causes repeated crashes
• Newly installed software makes Windows unstable
• A configuration change prevents normal startup
• A serious software problem leaves Windows unable to boot

The important thing is to understand its limits.

Point-in-Time Restore protects against certain system failures, but it doesn’t replace a proper backup strategy.

If a drive physically dies, becomes corrupted, or is hit by ransomware, having a local recovery snapshot on that same drive may not save your data.

Final Thoughts

Microsoft’s Point-in-Time Restore is one of the more practical improvements to Windows recovery in recent years.

The feature doesn’t try to reinvent troubleshooting. Instead, it addresses a simple problem: sometimes the fastest way to fix a broken computer is to return it to the state it was in before everything went wrong.

That’s particularly valuable after the kind of widespread software failure that Windows experienced during the CrowdStrike outage in 2024.

The automatic snapshots, integration with Windows Recovery Environment, and relatively modest storage requirements make the feature easy to live with.

Just remember one crucial rule: Point-in-Time Restore is a recovery mechanism, not a backup.

Keep important files backed up independently, store your BitLocker recovery key somewhere safe, and enable Point-in-Time Restore if your Windows installation supports it.

When the next “it worked perfectly yesterday” disaster arrives, having a recent snapshot could turn hours of troubleshooting into a relatively straightforward recovery.